As of late 2015 the issue of cyber attacks has, after a series of high profile and damaging hacks, become one of the leading security concerns for both corporations and nation states. As a result the field of cyber security has become increasingly important. Traditional approaches to cyber security rely on signature based approaches where a system is built that looks for behaviors that match those of previously seen attacks. However, these methods fail to offer protection against so called zero-day attacks where an adversary uses a previously unknown exploit to compromise a computer or network.
Traditional deterministic approaches are reliant on the assumption that the difference between what is legitimate activity and what is illegitimate activity can be defined. An expanding set of corporate policy and rules have been written to identify client programs as either compliant or not compliant. However, such deterministic approaches require a vast amount of effort to be spent in constantly updating these rules and signatures, in an attempt to stay up to date with the changing threat environment. The definition of what is legitimate is based on what is known about past attacks. For each successful intrusion, a new rule is written, the signature is updated and the next time that same threat presents itself, access is denied or challenged. This method is effective in defending against known threats that have already been identified. However, it is incapable of responding to fresh threats that are constantly presenting either through minor adjustments to existing vectors or more significant evolution of attack methods. Consequently, current threat detection and prevention systems are still being compromised and are unable to keep out threats.
Furthermore, as the technical defenses that protect our data have become more sophisticated, attackers have increasingly turned their attention to the softest part of the network, the user. Socially-engineered attacks account for over 85% of espionage threat, and were the fastest-growing attack vector of 2012. Attackers use subtle and sophisticated methods to manipulate human users to unwittingly install attacks on their behalf, and traditional technical defenses are rendered impotent within a process where a legitimate user has decided to click on a link in a ‘weaponized’ email or visited a familiar yet now compromised website. These new forms of attack make the problem of detecting threats even harder.